Also because so much of software is uniquely poorly suited to obscurity. Attackers will often be able to probe the "obscure" system at their leisure trying to reverse it, or in non-SAAS cases get their hands on the actual (compiled) algorithm itself. And once you figure it out every single copy works exactly the same.

It's not like trying to measure the penetrating capabilities of a tank round, where you need physical access to a batch of large, expensive, explosive, tightly controlled objects to figure it out.